Get macfor Pro

Pro plugin

Google Chrome Browser

Collects Chrome browsing history, downloads, bookmarks, cookies, autofill, extensions, local storage, and sessions

browser.chromePromacOS 10.12+v1.0.0browseruserweb

Run this plugin

Trigger collection for Google Chrome Browser on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin browser.chrome --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin browser.chrome --dry-run

Compatibility

  • macOS 10.12+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (19)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

history

ArtifactFormatPathNotes
Browsing History
history
sqlite~/{variant_path}/{profile}/History—
Top Sites
top_sitesOptional
sqlite~/{variant_path}/{profile}/Top Sites—
Omnibox Shortcuts
shortcutsOptional
sqlite~/{variant_path}/{profile}/Shortcuts—
Network Action Predictor
network_action_predictorOptional
sqlite~/{variant_path}/{profile}/Network Action Predictor—
Media History
media_historyOptional
sqlite~/{variant_path}/{profile}/Media History—

downloads

ArtifactFormatPathNotes
Downloads
downloads
sqlite~/{variant_path}/{profile}/HistoryTables: downloads, downloads_url_chains

bookmarks

ArtifactFormatPathNotes
Bookmarks
bookmarks
json~/{variant_path}/{profile}/Bookmarks—

cookies

ArtifactFormatPathNotes
Cookies
cookiesOptionalSensitive
sqlite~/{variant_path}/{profile}/Cookies—

credentials

ArtifactFormatPathNotes
Login Data
login_dataOptionalSensitive
sqlite~/{variant_path}/{profile}/Login Data—

autofill

ArtifactFormatPathNotes
Web Data (Autofill)
web_dataOptionalSensitive
sqlite~/{variant_path}/{profile}/Web Data—

extensions

ArtifactFormatPathNotes
Extensions
extensionsOptional
directory~/{variant_path}/{profile}/Extensions/*—

storage

ArtifactFormatPathNotes
Local Storage
local_storageOptional
leveldb~/{variant_path}/{profile}/Local Storage/leveldb—
Session Storage
session_storageOptional
leveldb~/{variant_path}/{profile}/Session Storage—
IndexedDB
indexeddbOptional
leveldb~/{variant_path}/{profile}/IndexedDB/*—

session

ArtifactFormatPathNotes
Session Files
sessionsOptional
snss~/{variant_path}/{profile}/Current Session
+3 more
  • ~/{variant_path}/{profile}/Current Tabs
  • ~/{variant_path}/{profile}/Last Session
  • ~/{variant_path}/{profile}/Last Tabs
—

config

ArtifactFormatPathNotes
Preferences
preferencesOptional
json~/{variant_path}/{profile}/Preferences—

cache

ArtifactFormatPathNotes
Favicon Cache
faviconsOptionallow value
sqlite~/{variant_path}/{profile}/Favicons—
Browser Cache
cacheOptionalmedium value
directory~/{variant_path}/{profile}/Cache/Cache_Data—
GPU Cache
gpu_cacheOptionallow value
directory~/{variant_path}/{profile}/GPUCache—